Attacks don't happen automatically (app will be installed after download). Afaik, android also has a default setting to prevent app installation from outside the store. The attacker has to make every pretext in the first file sent with the .txt extension so that the victim disables security and installs the app, then the attack begins.
That's correct, you need to execute the file by double clicking on it so it can download the payload. You need to be very cautious and check the extension of the file before opening it. In this example, it's supposed to be a word text file so it's supposed to end with .doc or .docx not .word.exeThis is the reason why I create another email for communication I received a lot of emails with docs and pdf followed by .exe which is executable, I am educated enough to delete any emails with .exe attachments, they send these emails with very compelling titles on the headers.
The rule of thumb is never to entertain emails coming from an unknown source even if the title is very attractive to open, these hackers are good at marketing their malware, and always watch out for attachments with .exe on it.
